Test ID:	1.3.6.1.4.1.25623.1.0.16279
Category:	Web application abuses
Title:	Uebimiau Session Directory Disclosure
Summary:	Uebimiau in default installation create one temporary folder; to store 'sessions' and other files. This folder is defined in 'inc/config.php' as './database/'.
Description:	Summary: Uebimiau in default installation create one temporary folder to store 'sessions' and other files. This folder is defined in 'inc/config.php' as './database/'. Vulnerability Impact: If the web administrator don't change this folder, an attacker can exploit this using the follow request: http://example.com/database/_sessions/ Affected Software/OS: Uebimiau <= 2.7.2 are known to be vulnerable. Other versions might be affected as well. Solution: 1) Insert index.php in each directory of the Uebimiau 2) Set variable $temporary_directory to a directory not public and with restricted access, set permission as read only to 'web server user' for each files in $temporary_directory. 3) Set open_basedir in httpd.conf to yours clients follow the model below: php_admin_value open_basedir /server-target/public_html CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Copyright	Copyright (C) 2005 Noam Rathaus

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.